ASA 5505 Vlan1/Inside Interface Down

I did an initial setup of an ASA 5505 using the setup wizard.
The inside interface is showing down/down.  It is not shutdown in the running config.
The ethernet ports say "available but not configured via nameif."
Anyone have some ideas for me to check?
ethernet0/0 is working with no problems.

Thank you for your question.  This community is for Cisco Small Business products and your question is in reference to a Cisco Elite/Classic product.  Please post your question in the Cisco NetPro forums located here: http://forums.cisco.com/eforum/servlet/NetProf?page=main  This forum has subject matter experts on Cisco Elite/Classic products that may be able to answer your question.
Brian

Similar Messages

  • ASA 5505/5510 Management Interface

    Hi,
    Does anyone know a workaround to this limitation? (other than the "management-access" command for VPN connections)
    Management access to an interface other than the one from which you entered the ASA is not supported. For example, if your management host is located on the outside interface, you can only initiate a management connection directly to the outside interface.
    Thanks!

    Hi,
    If you need  to ssh for XYZ  (name) instead of real IP, you need to make a mapping on your DNS server. ASA will not do this mapping or resolution.
    Thanks,
    Prashant Joshi

  • VPN ASA inside Interface and ip pool are one same Subnet

    Hi Everyone,
    I have configured RA VPN full tunnel.
    Inside interface of ASA is
    Vlan1                    inside                 10.0.0.1        255.255.255.0   CONFIG
    ip local pool 10-pool 10.0.0.51-10.0.0.100 mask 255.255.255.0
    Need to know is it good design to have both on same subnet?
    When i access the Switch  connecting to VPN ASA  inside interface via--https://10.0.0.2
    which has IP 10.0.0.2  while using Remote VPN connection to ASA it does not work gives error
    message as below
    Jan 19 2014 19:42:46: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.0.0.51/51077(LOCAL\ipsec-user) dst inside:10.0.0.2/443 denied due to NAT reverse path failure.
    Jan 19 2014 19:42:57: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.0.0.51/51078(LOCAL\ipsec-user) dst inside:10.0.0.2/443 denied due to NAT reverse path failure
    Jan 19 2014 19:42:59: %ASA-6-302014: Teardown TCP connection 22418 for outside:10.0.0.51/51069(LOCAL\ipsec-user) to identity:10.0.0.1/443 duration 0:01:08 bytes 1035 TCP Reset-O (ipsec-user)
    Jan 19 2014 19:42:59: %ASA-6-106015: Deny TCP (no connection) from 10.0.0.51/51069 to 10.0.0.1/443 flags FIN ACK  on interface outside
    Current NAT config is
    nat (inside,outside) source dynamic any interface
    Regards
    MAhesh
    Message was edited by: mahesh parmar

    Hi Mahesh,
    It should work but I generally would not suggest having the same network on the LAN and also configured partially as a VPN Pool network.
    Your problem at the moment is simply lacking the NAT0 configuration for the traffic between LAN and VPN Pool.
    I would suggest changing the VPN Pool first and then configuring this
    object network LAN
    subnet 10.0.0.0 255.255.255.0
    object network VPN-POOL
    subnet
    nat (inside,outside) 1 source static LAN LAN destination static VPN-POOL VPN-POOL
    We have to use the line number "1" in the above command so that it gets moved to the top since your current Dynamic PAT would otherwise override it.
    In the future it would be best if you changed your current Dynamic PAT configuration to this
    nat (inside,outside) after-auto source dynamic any interface
    We simply add the "after-auto" to this Dynamic PAT configuration so that it gets moved down in priority. The "after-auto" refers to the fact that this NAT will be inserted after Auto NAT (after Section 2). Your current rule is Manual NAT (Sectiom 1). The new rule will be Manual NAT (Section 3)
    - Jouni

  • Routing Issue Accessing Inside Interface of ASA

    Ok so I'm making this more complex than it needs to be and can't see the forest for the trees. I'm setting up an ASA 5510 with multiple contexts. I'm working with my main internal context for my internal traffic. I have created interfaces on this context as follows:
    interface Ethernet0/0.1
    description outside interface
    nameif outside
    security-level 0
    ip address 1.1.1.2 255.255.255.252
    interface Ethernet0/1.1
    description inside interface for internal context
    nameif inside
    security-level 100
    ip address 10.10.50.150 255.255.0.0
    same-security-traffic permit intra-interface
    route outside 0.0.0.0 0.0.0.0 1.1.1.1
    NOTE: Also has ssh configuration but can't document that here.
    My workstation has an IP 10.10.30.20 255.255.0.0 with a default gateway that points to my core switch (10.10.50.151).
    When I try to access the inside interface of the ASA via ssh from my workstation I can't connect. I tried to ping the inside interface IP address of the ASA from my workstation and it doesn't reply. I can however ping anything on my internal network from the ASA through the inside interface. What am I missing on this?
    Thanks.

    I figured out this issue but now have a new issue. The problem I had accessing the internal network from the ASA was due to the core switch I was being routed through. After looking at the core I saw that the default route was redirecting all traffic to the IP address of the inside interface on the production ASA. I have since pulled a spare switch and created an isolated network with a laptop and the inside interface on the new ASA. This worked great.
    Now to my new problem. I am trying to access our ISPs external address from the ASA. The ISP has provided us with two vlans (100 and 101) on one connection and has given us two public IPs (one is the IP for the router on their end and the second is the IP I am supposed to use on my outside interface for vlan 100). I have created sub-interfaces on my outside interface and defined 0/0.1 as vlan 100 and 0/0.2 as vlan 101. VLAN 101 will go to our rack at our disaster recovery site so it will just be an extension of our existing network.
    My network is as follows:
                                   ISP (IP 2.2.2.1)
                                            |
                                            |
                                   3560-CG switch (both ports -- to ISP and ASA outside interface are configured as trunk ports)
                                            |
                                            |
                                   ASA (outside 2.2.2.2 vlan 100)
    When I try to ping the 2.2.2.1 address from the ASA it doesn't work. If both my ASA outside port and the port to the ISP are both trunk ports shouldn't it route both VLANs (100 and 101) without any issue or am I missing something in my thinking?
    Thanks.

  • ASA 5505 ssh access question

    Hi,
    Currently any ip address can ssh to my asa 5505 firewall outside interface. What should I do to restrict only certain IP can? What's the command to see the current ssh management access rule?
    Thanks.
    Ye 

    I tried this and got an error. Please help.
    CL-T179-12IH# ssh 162.221.204.59 255.255.255.255 outside
                                     ^
    ERROR: % Invalid input detected at '^' marker.
    Also when I do   "show run ssh" I see below line. How to remove it?
    ssh 0.0.0.0 0.0.0.0 outside
    Thanks.
    Ye

  • ASA 5505 backup interface

    Hello,
    I have setup ASA 5505 with 2 ISP, named outside (primary)  and backup, the scenario is if outside down, then backup will take over, it works now.
    But it is not working when the primary connection cannot reach the gateway with the interface still up.
    Is it possible when the primary connection cannot reach the gateway then backup automatically take over?
    Thanks before..
    My configuration is:
    ASA Version 8.2(1)
    hostname cisco
    domain-name default_domain
    enable password ********* encrypted
    passwd ********* encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 172.10.10.10 255.255.255.0
    interface Vlan3
    no forward interface Vlan2
    nameif backup
    security-level 0
    ip address 172.20.10.10 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 1
    interface Ethernet0/1
    switchport access vlan 2
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default domain
    same-security-traffic permit intra-interface
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu backup 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (inside) 1 interface
    global (outside) 1 interface
    global (backup) 1 interface
    nat (inside) 1 192.168.1.0 255.255.255.0
    access-group inside_out in interface inside
    access-group outside_in in interface outside
    access-group backup_in in interface backup
    route outside 0.0.0.0 0.0.0.0 172.10.10.1 1
    route backup 0.0.0.0 0.0.0.0 172.20.10.1 254
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd lease 1048575
    dhcpd auto_config outside
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:24af050f332deab3e38eb578f8081d05
    : end

    Hi Amrin,
    you can configure SLA monitoring on ASA and that woudl work fine for you:
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
    Hope that helps.
    Thanks,
    Varun

  • ASA 5505 Unable to assign ip to DMZ vlan interface

    hi all,
    I have ASA  5505 with base license.
    I created 3rd  vlan on it.it was created.
    but i am unable to assign IP to it.
    i assign ip address it takes it.
    But when i do sh int ip brief it does not show any ip.
    ciscoasa# sh int ip brief
    Interface                  IP-Address      OK? Method Status                Prot
    ocol
    Ethernet0/0                unassigned      YES unset  up                    up
    Ethernet0/1                unassigned      YES unset  up                    up
    Ethernet0/2                unassigned      YES unset  up                    up
    Ethernet0/3                unassigned      YES unset  administratively down down
    Ethernet0/4                unassigned      YES unset  administratively down down
    Ethernet0/5                unassigned      YES unset  administratively down down
    Ethernet0/6                unassigned      YES unset  administratively down down
    Ethernet0/7                unassigned      YES unset  administratively down down
    Internal-Data0/0           unassigned      YES unset  up                    up
    Internal-Data0/1           unassigned      YES unset  up                    up
    Vlan1                      192.168.1.1     YES CONFIG up                    up
    Vlan2                      192.168.11.2    YES CONFIG up                    up
    Vlan3                      unassigned      YES manual up                    up*************************************************************
    Virtual0                   127.0.0.1       YES unset  up                    up
    ciscoasa# config t
    ciscoasa(config)# int vlan 3
    ciscoasa(config-if)# ip ad
    ciscoasa(config-if)# ip address 192.168.12.2 255.255.255.0
    ciscoasa(config-if)# end
    ciscoasa# wr mem
    Building configuration...
    Cryptochecksum: 808baaba ced2a226 07cfb41f 9f6ec4f8
    4608 bytes copied in 1.630 secs (4608 bytes/sec)
    [OK]
    ciscoasa# sh int ip brief
    Interface                  IP-Address      OK? Method Status                Prot
    ocol
    Ethernet0/0                unassigned      YES unset  up                    up
    Ethernet0/1                unassigned      YES unset  up                    up
    Ethernet0/2                unassigned      YES unset  up                    up
    Ethernet0/3                unassigned      YES unset  administratively down down
    Ethernet0/4                unassigned      YES unset  administratively down down
    Ethernet0/5                unassigned      YES unset  administratively down down
    Ethernet0/6                unassigned      YES unset  administratively down down
    Ethernet0/7                unassigned      YES unset  administratively down down
    Internal-Data0/0           unassigned      YES unset  up                    up
    Internal-Data0/1           unassigned      YES unset  up                    up
    Vlan1                      192.168.1.1     YES CONFIG up                    up
    Vlan2                      192.168.11.2    YES CONFIG up                    up
    Vlan3                      unassigned      YES manual up                    up
    Virtual0                   127.0.0.1       YES unset  up                    up
    ciscoasa# sh ver
    Cisco Adaptive Security Appliance Software Version 8.2(5)
    Device Manager Version 6.4(9)
    Compiled on Fri 20-May-11 16:00 by builders
    System image file is "disk0:/asa825-k8.bin"
    Config file at boot was "startup-config"
    ciscoasa up 3 days 17 hours
    Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.05
    0: Int: Internal-Data0/0    : address is 001d.a24d.ed0e, irq 11
    1: Ext: Ethernet0/0         : address is 001d.a24d.ed06, irq 255
    2: Ext: Ethernet0/1         : address is 001d.a24d.ed07, irq 255
    3: Ext: Ethernet0/2         : address is 001d.a24d.ed08, irq 255
    4: Ext: Ethernet0/3         : address is 001d.a24d.ed09, irq 255
    5: Ext: Ethernet0/4         : address is 001d.a24d.ed0a, irq 255
    6: Ext: Ethernet0/5         : address is 001d.a24d.ed0b, irq 255
    7: Ext: Ethernet0/6         : address is 001d.a24d.ed0c, irq 255
    8: Ext: Ethernet0/7         : address is 001d.a24d.ed0d, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces    : 8
    VLANs                          : 3, DMZ Restricted
    Inside Hosts                   : Unlimited
    Failover                       : Disabled
    VPN-DES                        : Enabled
    VPN-3DES-AES                   : Enabled
    SSL VPN Peers                  : 2
    Total VPN Peers                : 10
    Dual ISPs                      : Disabled
    VLAN Trunk Ports               : 0
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled
    AnyConnect for Cisco VPN Phone : Disabled
    AnyConnect Essentials          : Disabled
    Advanced Endpoint Assessment   : Disabled
    UC Phone Proxy Sessions        : 2
    <--- More --->
    Need to know does this License support IP  to 3rd vlan ?
    Thanks
    Mahesh

    Hi Julio,
    I tried to config namef if but here is result
    ciscoasa# sh run int vlan 3
    interface Vlan3
    description DMZ  to 3550 New Switch
    no nameif
    security-level 50
    ip address 192.168.12.2 255.255.255.0
    ciscoasa# config t
    ciscoasa(config)# int vlan 3
    ciscoasa(config-if)# name
    ciscoasa(config-if)# namei
    ciscoasa(config-if)# nameif DMZ
    ERROR: This license does not allow configuring more than 2 interfaces with
    nameif and without a "no forward" command on this interface or on 1 interface(s)
    with nameif already configured.

  • ASA 5505 Logging Issue - Warning: Configured logging host interface conflicts with route table entry

    I am getting this warning on my ASA 5505 when I try to set up logging from my off site FW to the central FW, which is a 5510. What I am trying to do is send the FW logs through the VPN Tunnel into the central 5510 to our logging server at 192.168.22.99, but allow all other traffic out the outside interface so customers can hit our web servers down there. Here is an example of my config with fake IP's. I get this error when trying to do "logging inside host 192.168.22.99". If I try to put in "logging Tunnel host 192.168.22.99" I get the "Warning:Security Level is 1" message
    5505
    ethe0/0
    desc To LA ISP (217.34.122.1)
    switchport access vlan2
    ethe0/1
    desc To Redwood City HQ via VPN Tunnel
    switchport access vlan1
    ethe0/2
    desc To Internal Web Server
    switchport access vlan3
    VLAN1
    desc Tunnel to HQ
    ifinterface Tunnel
    security level 1
    217.34.122.3 255.255.255.248
    VLAN3
    desc Internal Web Server
    ifinterface inside
    security level 100
    192.168.0.1 255.255.255.0
    access-list LosAngeles extended permit ip 192.168.0.0 255.255.255.0 192.168.22.0 255.255.255.0
    (No access-group is performed, as I match from the crypto map instead since I have multiple sites going out of HQ - see HQ configs)
    route Tunnel 192.168.22.0 255.255.255.0 65.29.211.198
    crypto map TO-HQ 10 match address LosAngeles
    crypto map TO-HQ set peer ip 65.29.211.198
    5510 at HQ
    access-list LA extended permit ip 192.168.22.0 255.255.255.0 192.168.0.0 255.255.255.0
    (again no access-group, since I have a couple other off sites)
    crypto map TO-LA 20 match address LA
    crypto map TO-LA 20 set peer ip 217.34.122.3

    Hi Jouni,
    I have the following configs in place with fake IPs
    5505
    1 outside interface with security level 0 (vlan1 direct connect to isp 217.33.122.2/30) - goes to ISP
    1 Tunnel interface with security level 1 (vlan 2 direct connect to isp 217.33.122.6/30) - goes to Tunnel to our 5510
    1 inside interface with security level 100 (servers connected to hub, with vlan3 ip of 192.168.0.1)
    access-list LosAngeles extended permit ip 192.168.0.0 255.255.255.0 192.168.22.0 255.255.255.0 - acl to 5510 inside network
    route outside 0.0.0.0 0.0.0.0 217.33.122.1 - route for all traffic (except for 192.168.22.0/24) to take the outside connection
    route Tunnel 192.168.22.0 255.255.255.0 65.29.211.198 - route for 192.168.22.0 destined traffic to take the Tunnel connection
    crypto map  TO-HQ 10 match address LosAngeles
    crypto map TO-HQ 10 set peer ip 65.29.211.198
    tunnel-group 65.29.211.198 type ipsec-l2l
    5510
    1 outside interface with security level 0 (vlan1 direct connect to isp 65.29.211.198) - goes to isp
    1 inside interface with security level 100 (vlan2 connection to corporate servers and SIP 192.168.22.0/24)
    access-list LA extended permit ip 192.168.22.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list OUTBOUND extended permit icmp host 217.33.122.6 host 192.168.22.99 (allows Nagios monitor to ping the DE interface
    access-group OUTBOUND in interface outside
    nat (inside,outside) static 192.168.22.99 interface destination static 217.33.122.6
    route outside 192.168.0.0 255.255.255.0 217.33.122.6
    crypto map TO-LA 20 match address LA
    crypto map TO-LA 20 set peer ip 217.33.122.6
    tunnel-group 217.33.122.6 type ipsec-l2l
    I am mistaken on the 5510 interfaces. They do not have vlans, and the IP address is directly applied to the interfaces for outside and inside.

  • Asa 5505, the outside cant access to a server in the inside

    hi, i have an Asa 5505, a pc in the outside with the ip 10.1.1.6 cant access to a server in the inside 192.168.1.4, pls help...
    this is my conf:
    ASA Version 8.0(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 0
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 10.1.1.2 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    boot system disk0:/asa804-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    access-list 100 extended permit tcp any host 10.1.1.3 eq www
    pager lines 24
    logging enable
    logging asdm debugging
    mtu inside 1500
    <--- More --->
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-613.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) 10.1.1.3 192.168.1.4 netmask 255.255.255.255
    access-group 100 in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    <--- More --->
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.2-192.168.1.254 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    <--- More --->
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:14e7b74fabc386613ae646b915f60e9e
    : end
    ciscoasa#

    Andres
    The security level for your inside interface should be 100 ie.
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    After changing that can you
    1) ping the outside interface of the ASA from the pc or ping the PC from the ASA
    2) I'm assuming you are trying to connect to 10.1.1.3 when you attempt the connection ?
    Jon

  • Connect Inside to Outside in ASA 5505

    Hi there,
    I have a test ASA 5505 with the setting below:
    How can I connect to the internet (Vlan 1 to VLan 11)
    TestASA5505#  show run
    : Saved
    ASA Version 8.2(4)
    hostname TestASA5505
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 11
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.99.1 255.255.255.0
    interface Vlan11
    nameif outside
    security-level 0
    ip address 192.168.1.4 255.255.255.0
    boot system disk0:/asa824-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    route outside 0.0.0.0 255.255.255.255 192.168.1.4 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.99.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd address 192.168.99.3-192.168.99.30 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 rc4-md5
    webvpn
    username admin password S1xyD1w.ZbjUT1yX encrypted privilege 15
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:096682b0996d6a1cad76597c01ffe5e2
    : end
    TestASA5505#
    Thank you in Advance for your time

    Hi,
    What device is in front of the ASA?
    Is there some ADSL modem doing NAT and providing Internet connection or something?
    One obvious problem in the above configuration is the route
    route outside 0.0.0.0 255.255.255.255 192.168.1.4 1
    Its not actually even a default route and furthermore its pointing to the ASA itself
    It should be something like this
    route outside 0.0.0.0 0.0.0.0 192.168.1.x
    Where the 192.168.1.x is the IP of the device providing the Internet connectivity to the ASA (Since ASA "outside" interface is using private IP address range)
    If there ASA doesnt need to do any NAT then you could also add this
    access-list INSIDE-NAT0 permit ip 192.168.99.0 255.255.255.0 any
    nat (inside) 0 access-list INSIDE-NAT0
    Also your DHCP configurations dont have any DNS servers defined.
    dhcpd dns
    - Jouni

  • ASA 5505 unable to connect inside or outside

    Hello,
    I'm extremely new to router configurations, and am attempting to configure a backup ASA 5505 to use as a temporary access point in the event that our main ASA becomes unavailable. What I have done is loaded the running config from our main ASA onto the backup, and have made changes to necessary routes, IPs, etc. I can connect to it from a remote computer without problem, but I cannot access any of our servers, nor can I access the internet. I have also tried modifying the access list and NAT rules every which way from Sunday, but I still cannot get this thing to allow any information through. I keep getting "failed to locate egress interface for UDP from outside" errors.
    We are using Cisco AnyConnect to connect , and mind you, since the config for this backup ASA was taken from our main, it still has the original certificate info and profiles. I was told that this wouldn't matter, but I thought I should mention in case I need to remove any of it from the config.
    Here is part of the config file. I took out some information, but tried to keep it understandable. If anyone could point me in the right direction, it would be greatly appreciated!
    ciscoasa# show running-config
    : Saved
    : Serial Number: xxxxxxxxxxx
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.2(2)
    hostname ciscoasa
    domain-name domain
    enable password encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd encrypted
    names
    ip local pool pool1 x.x.9.22-x.x.9.254 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address x.x.8.10 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address x.x.x.237 255.255.255.248
    boot system disk0:/asa922-k8.bin
    boot config disk0:/startup-config
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group Default
     name-server x.x.8.100
     domain-name domain
    same-security-traffic permit intra-interface
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network pool1
     subnet x.x.9.0 255.255.255.0
    object network outside-network
     host x.x.x.237
    object network Remote-Network
     subnet x.x.8.0 255.255.255.0
    object network local
    object network obj-x.x.9.24
     host x.x.9.24
    object-group network Outside-Network-Group
     description Outside Network Group
     network-object x.x.x.232 255.255.255.248
    object-group network Inside-Network-Group
     description Inside Network Group
     network-object x.x.8.0 255.255.255.0
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended permit ip any any
    access-list NONAT extended permit ip x.x.8.0 255.255.255.0 x.x.9.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 30000
    logging buffered debugging
    logging asdm informational
    no logging message 106015
    no logging message 313001
    no logging message 313008
    no logging message 106023
    no logging message 710003
    no logging message 106100
    no logging message 302015
    no logging message 302014
    no logging message 302013
    no logging message 302018
    no logging message 302017
    no logging message 302016
    no logging message 302021
    no logging message 302020
    flow-export destination inside x.x.8.132 2055
    flow-export template timeout-rate 1
    flow-export delay flow-create 50
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    asdm image disk0:/asdm-722.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static any any destination static pool1 pool1 no-proxy-arp route-lookup
    nat (inside,outside) source static any any destination static Remote-Network Remote-Network no-proxy-arp route-lookup
    nat (outside,outside) source dynamic pool1 interface
    object network obj_any
     nat (inside,outside) dynamic interface
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 x.x.x.232 1
    route inside x.x.11.0 255.255.255.0 x.x.11.1 1
    If you have any questions, or need any other information, please let me know.
    Thanks!

    Am I posting this in the wrong section? Anyone?

  • ASA 5505 VPN can't access inside host

    I have setup remote VPN access on a ASA 5505 but cannot access the host or ASA when I login using the VPN. I can connect with the Cisco VPN client and the VPN light is on on the ASA and it shows that I'm connected. I have the correct Ip address but I cannot ping or connect to any of the internal addresses. I cannot find what I'm missing. I have the VPN bypassing the interface ACLs. Since I can login but not go anywhere I feel certian I missed something.
    part of config below
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    ip local pool xxxx 10.1.1.50-10.1.1.55 mask 255.255.255.0
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto dynamic-map inside_dyn_map 20 set pfs
    crypto dynamic-map inside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map
    crypto map inside_map interface inside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    service-policy global_policy global
    group-policy xxxxxxx internal
    group-policy xxxxxxx attributes
    banner value xxxxx Disaster Recovery Site
    wins-server none
    dns-server value 24.xxx.xxx.xx
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelall
    default-domain none
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout none
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools value xxxxxx
    smartcard-removal-disconnect enable
    client-firewall none
    webvpn
    functions url-entry
    vpn-nac-exempt none
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    tunnel-group xxxx type ipsec-ra
    tunnel-group xxxx general-attributes
    address-pool xxxx
    default-group-policy xxxx
    tunnel-group blountdr ipsec-attributes
    pre-shared-key *

    I get the banner and IP adress info...
    This is what the client log provides...
    1 13:45:32.942 05/30/08 Sev=Warning/2 CVPND/0xE3400013
    AddRoute failed to add a route: code 87
    Destination 172.20.255.255
    Netmask 255.255.255.255
    Gateway 10.1.2.1
    Interface 10.1.2.5
    2 13:45:32.942 05/30/08 Sev=Warning/2 CM/0xA3100024
    Unable to add route. Network: ac14ffff, Netmask: ffffffff, Interface: a010205, Gateway: a010201.

  • ASA 5505 NAT rules blocking inside traffic

    Previous attempts to set up these NAT rules has been met with minimal success. We have been able to get the NAT rules created, and able to ping our inside servers and receivers from a  different outside network, but every time we get that far our internal network crashes.  Running the Packet Trace utility via the ASDM shows that internal traffic from the servers to  the workstations is being blocked by the default implicit rule under the access rule heading  that states "any to any, service being ip, action= deny". Reverse traffic from the workstations to  the servers is being allowed though. In an effort to start over again, the Cisco ASA has been  Factory Defaulted via the CLI, and has had it's Inside network, and Outside IP address set back up. DHCP pool has been setup for a minimal amount of addresses on the   inside network, since  most of our equipment will always be assigned statics. We reset our static NAT policies, and  seem to be having the same problem. My partner and I have been working on this for some time now, and have ourselves so frustrated that I know we are missing something simple. Any help will be greatly appreciated.
    Embarq :          Network                                      xxx.xxx.180.104
    Gateway:                                                             xxx.xxx.180.105
    Subnet Mask:                                                     255.255.255.248
    Our Static IP's:                                                    xxx.xxx.180.106 to xxx.xxx.180.110
    Cisco Pix for VPN tunnels :                              xxx.xxx.180.107  outside IP
        used for DataBase Servers :                        100.1.0.2  Inside IP/ Gateway 2
    Cisco ASA 5505:                                               xxx.xxx.180.106  outside IP
        all other traffic :                                              100.1.0.1  Inside IP/ Gateway 1
    Inside Network:                                                 100.1.0.0/24
    Application Server:                                          100.1.0.115 uses Gateway 1
    BackUp AppSrvr:                                             100.1.0.116 uses Gateway 1
    DataBase Server:                                            100.1.0.113 uses Gateway 2
    BackUp DBSrvr:                                               100.1.0.114 uses Gateway 2
    Cobox/Receiver:                                               100.1.0.140
    BackUp Cobox:                                                 100.1.0.150
    Workstation 1:                                                   100.1.0.112
    Workstation 2:                                                   100.1.0.111
    Network Speaker1,2,3,4:                                 100.1.0.125 to 100.1.0.128
    Future Workstations:                                        100.1.0.0/24
    1.           Embarq Gateway feeds both Cisco Pix, and Cisco ASA. Both Ciscos feed a Dell Switch.
    2.           All inside network devices at 100.1.0.0/24 are networked into the Dell Switch.
    3.           All Workstations/Network Speakers need to be able to communicate with all four servers, and   the Cobox/Receiver.
    4.          The DataBase Servers have VPN tunnels created in the Pix for clients to be able to login  securely and edit their account info.
    5.          The App Server (100.1.0.115), and BackUp App Srvr (100.1.0.116) need to have a NAT rule  created NAT'ing them to xxx.xxx.180.109.
          A.          The xxx.xxx.180.109 NAT rule needs to allow ALL UPD traffic TO and FROM ANY outside    IP address.
          B.          The xxx.xxx.180.109 NAT rule needs to allow ICMP traffic FROM ANY Outside IP address.
    6.          The Cobox/Receiver (100.1.0.140) and BackUp Cobox (100.1.0.150) need to have a NAT rule created NAT'ing them to xxx.xxx.180.108
          A.          The xxx.xxx.180.108 NAT rule needs to allow UDP traffic FROM ANY Outside IP address source port 6000 or 9000 to destination port 9000
          B.           The xxx.xxx.180.108 NAT rule needs to allow ICMP traffic FROM ANY Outside IP address.
    7.          Right now the Cisco PIX is functioning and working perfectly for our VPN tunnels.
    8.         
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 100.1.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address xxx.xxx.180.106 255.255.255.248
    ftp mode passive
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_4
    protocol-object icmp
    protocol-object udp
    object-group protocol DM_INLINE_PROTOCOL_5
    protocol-object icmp
    protocol-object udp
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_3 any xxx.xxx.180.104 255.255.255.248
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_4 host xxx.xxx.180.108 any
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_5 host xxx.xxx.180.108 any
    access-list inside_access_allow extended permit object-group DM_INLINE_PROTOCOL_2 100.1.0.0 255.255.255.0 100.1.0.0 255.255.255.0
    access-list inside_access_allow extended permit object-group DM_INLINE_PROTOCOL_1 any any
    access-list inside_nat_static extended permit udp host 100.1.0.140 eq 9000 any
    access-list inside_nat_static_1 extended permit ip host 100.1.0.115 any
    access-list inside_nat0_outbound extended permit ip 100.1.0.0 255.255.255.0 100.1.0.0 255.255.255.0
    access-list outside_nat_static extended permit udp host xxx.xxx.180.108 eq 6000 host 100.1.0.140
    access-list outside_nat_static_1 extended permit ip host xxx.xxx.180.109 host 100.1.0.115
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat-control
    global (inside) 1 100.1.0.3-100.1.0.254 netmask 255.0.0.0
    nat (inside) 0 access-list inside_nat0_outbound
    static (inside,outside) udp xxx.xxx.180.108 6000 access-list inside_nat_static
    static (outside,inside) udp 100.1.0.140 9000 access-list outside_nat_static
    static (inside,outside) xxx.xxx.180.109  access-list inside_nat_static_1
    static (outside,inside) 100.1.0.115  access-list outside_nat_static_1
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 100.1.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 100.1.0.5-100.1.0.15 inside
    dhcpd dns 71.0.1.211 67.235.59.242 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:52e69fa95fcffd43ed9e73df320e3a55
    : end
    no asdm history enable

    OK. Thank you very much for your help. I am going to get with the powers that be to upgrade the "Base" license in this ASA.
    In the meantime I will Close and Rate this post for now so others can get this info also.
    If we have any further issues after the upgrade, then I will open a new post.
    Thanks again. We new it was something simple. Not sure how we overlooked that, but hey we're getting somewhere now.

  • ASA 5505 initial build - Failed to locate egress interface (Please help :-) )

    Hi, I have just purchased a ASA 5505 and have completed the initial setup via the wizard.  I am currently unable to access services on the outside of the ASA. 
    The error: 'Failed to locate egress interface for UDP from inside'....  appears when ever my DNS server attempts a lookup. 
    I have configured this several times from scratch using the wizard and I am unable to figure out the issue with the NAT / Routing config. 
    If I run the packet tracer I get the error: "(no-route) no route to host", however I do have a default route configured so I suspect it maybe my NAT configuration. 
    Overview, 192.168.10.0/24 inside the ASA, 192.168.1.0/24 outside the ASA, 192.168.1.1 is the gateway to the internet.  I ideally want the ASA to use PAT to mask the 192.168.10.0/24 network behind the ASAs 192.168.1.0/24 network address but still allow clients to gain internet access. 
    Full config follows, screen shots attached, any help would be very gratefully received. 
    Result of the command: "sh run"
    : Saved
    ASA Version 9.0(1)
    hostname firewall
    enable password (REMOVED) encrypted
    passwd (REMOVED) encrypted
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.10.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 192.168.1.254 255.255.255.0
    interface Vlan5
     no nameif
     security-level 50
     ip address dhcp
    ftp mode passive
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network Server1
     host 192.168.10.10
    object network GoogleDNS1
     host 8.8.8.8
     description Google DNS Server
    object network GoogleDNS2
     host 8.8.4.4
     description Google DNS Server
    object network 192.168.10.x
     subnet 192.168.10.0 255.255.255.0
    object network InternetRouter
     host 192.168.1.1
    object-group network DM_INLINE_NETWORK_1
     network-object object GoogleDNS1
     network-object object GoogleDNS2
    object-group service DM_INLINE_TCP_1 tcp
     port-object eq www
     port-object eq https
    access-list inside_access_in remark External DNS Lookups
    access-list inside_access_in extended permit udp object Server1 object-group DM_INLINE_NETWORK_1 eq domain
    access-list inside_access_in extended permit tcp 192.168.10.0 255.255.255.0 any object-group DM_INLINE_TCP_1
    access-list inside_access_in extended deny ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    object network obj_any
     nat (inside,outside) dynamic interface
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 255.255.255.255 192.168.1.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec security-association pmtu-aging infinite
    crypto ca trustpool policy
    telnet timeout 5
    ssh timeout 5
    ssh version 2
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:(REMOVED)
    : end

    Just to want to be sure, can you post output from show int ip brie and show route? And try to remove your ACL for testing purpose or at least don't applied it anywhere yet. 
    Once done, try do another packet-tracer to 8.8.8.8 using icmp packet instead of UDP paste the whole the output here. Before doing this, add icmp any any outside command on the ASA.
    I know this should have anything to do with your issue, because if ACL is the issue then you will see output being denied by ACL on the packet tracer output. Let us know the results.

  • ASA 5505 - Cannot ping outside natted interface

    Hello,
    I have a Cisco ASA 5505, the problem is I am not able to ping to outside natted interface (ip: 172.88.188.123 and 124 and 125) from inside network
    Could someone help me to resolve this? I have looked for ASA documentation through the internet and still got nothing.
    Thank you in advance
    the config are:
    : Saved
    ASA Version 8.2(1)
    hostname ciscoasa
    domain-name domain
    enable password ********** encrypted
    passwd ************ encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 172.88.188.122 255.255.255.248
    interface Vlan3
    no forward interface Vlan2
    nameif backup
    security-level 0
    no ip address
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name domain
    same-security-traffic permit intra-interface
    access-list outside_in extended permit tcp any host 172.88.188.123 eq smtp
    access-list outside_in extended permit tcp any host 172.88.188.123 eq pop3
    access-list outside_in extended permit tcp any host 172.88.188.123 eq www
    access-list outside_in extended permit icmp any any
    access-list outside_in extended permit icmp any any echo-reply
    access-list inside_out extended permit tcp 192.168.1.0 255.255.255.0 any
    access-list inside_out extended permit udp 192.168.1.0 255.255.255.0 any
    access-list inside_out extended permit icmp any any
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu backup 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    global (outside) 1 172.88.188.128
    nat (inside) 1 192.168.1.0 255.255.255.0
    static (inside,outside) 172.88.188.123 192.168.1.253 netmask 255.255.255.255
    static (inside,outside) 172.88.188.124 192.168.1.251 netmask 255.255.255.255
    static (inside,outside) 172.88.188.125 192.168.1.5 netmask 255.255.255.255
    route outside 0.0.0.0 0.0.0.0 172.88.188.121 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd lease 1048575
    dhcpd auto_config outside
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 8.8.8.8 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:865943aa325eb75812628fec3b1e7249
    : end

    You are looking for this. 2 options, dns doctoring, or hairpinning (2nd part of document.) Post back if you need help setting it up.
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml
    Hairpinning would look like this in your scenario.
    same-security-traffic permit intra-interface
    global (inside) 1 interface
    static (inside,inside) 172.88.188.123 192.168.1.253 netmask 255.255.255.255
    static (inside,inside) 172.88.188.124 192.168.1.251 netmask 255.255.255.255
    static (inside,inside) 172.88.188.125 192.168.1.5 netmask 255.255.255.255

Maybe you are looking for

  • Ctrl Alt Del and Task manager not working

    Hi, Ive been having a problem getting task manager to run at all. On a fresh reboot, if I use the ctrl alt del function the according screen will come up like normal, and I will click on task manager. It bring me back to my desktop and nothing pops u

  • Itunes will not open on win 7 pc after oct update?

    I am running a win7 pc-64bit os and itunes will not open since I updated it in Oct. I have attempted uninstalling and reinstalling the itunes s/w several times. I have tried without a firewall and with anti-virus programs disconnected. I do not get a

  • How i use jtable

    hi master sir how i use jtable please send me any detail sample with swing interfas and code thank's aamir

  • Authorizaion default button in PFCG

    Hi All, We have EP using which the users access ESS and MSS. When they try accessing certaing tabs in ESS/MSS, they are getting error of the kind "You do not have the authorization to start service sap.com/mss~ato/AttendanceOverviewApp" We have ECC6

  • Missing Album covers in iPhone/iPad (iTunes 11)... anyone?

    I was hoping with the update to iTunes that this problem would have been solved- i was WRONG. It's entirely disheartening that a problem that has existed for quite some time now continues, and not just with my iPhone 4 but also with my brand new iPad